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MEMORANDUM  FOR  DIRECTOR,  DEFENSE  CONTRACT  AUDIT  AGENCY 

SUBJECT:  Evaluation  of  Defense  Contract  Audit  Agency  Audits  of  Contractor 

Compliance  with  Cost  Accounting  Standards  (Report  No.  PO  99-6-001) 


We  are  providing  this  report  for  your  information  and  use  We  considered 
management  comments  on  a  draft  of  this  report  when  preparing  the  final  report 

Comments  on  the  draft  of  this  report  conformed  to  the  requirements  of  DoD 
Directive  7650.3  and  left  no  unresolved  issues.  Therefore,  no  additional  comments  are 
required. 

We  appreciate  the  courtesies  extended  to  the  evaluation  staff  Questions  on  the 
evaluation  should  be  directed  to  Ms.  Barbara  Smolenyak  at  (703)  604-8760 
(DSN  664-8760)  or  Ms.  Madelaine  E.  Fusfield  at  (703)  604-8739  (DSN  664-8739).  See 
Appendix  C  for  the  report  distribution.  The  evaluation  team  members  are  listed  inside  the 
back  cover 
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Defense  Contract  Audit  Agency  Audits  of  Contractor 
Compliance  with  Cost  Accounting  Standards 


Executive  Summary 


Introduction.  Section  26  of  the  Federal  Procurement  Policy  Act,  Public  Law  100-679, 
(title  41,  United  States  Code,  section  422)  requires  certain  contractors  and  subcontractors 
to  comply  with  Cost  Accounting  Standards  and  to  disclose  in  writing  and  follow 
consistently  their  cost  accounting  practices.  The  Cost  Accounting  Standards  establish 
criteria  and  principles  to  employ  in  selecting  from  alternative  cost  accounting  practices  in 
estimating,  accumulating,  and  reporting  costs.  The  purposes  of  the  Standards  are  to 
increase  uniformity  and  consistency  in  cost  accounting  practices  in  order  to  improve 
understanding  and  communication  in  contract  negotiations  and  settlements,  reduce  the 
incidence  of  disputes  and  disagreements,  and  facilitate  equitable  contract  settlements  The 
continued  need  for  Cost  Accounting  Standards  is  explained  in  Appendix  B  As  the 
primary  agency  for  performing  contract  audits,  the  Defense  Contract  Audit  Agency,  acting 
in  an  advisory  capacity,  is  responsible  for  making  recommendations  to  the  Administrative 
Contracting  Officer  as  to  whether  a  contractor’s  Disclosure  Statement  adequately 
describes  its  cost  accounting  practices,  the  disclosed  practices  comply  with  applicable 
Cost  Accounting  Standards,  or  the  contractor’s  failure  to  comply  or  consistently  follow  its 
disclosed  or  established  cost  accounting  practices  results  in  increased  cost  to  the 
Government 

Evaluation  Objectives.  The  overall  objective  was  to  evaluate  the  adequacy  of 
procedures  for  auditing  contractor  compliance  with  the  Cost  Accounting  Standards  The 
evaluation  assessed  the  adequacy  of  audit  guidance,  audit  programs,  training  materials, 
planning  procedures,  audit  coverage,  and  reporting 

Evaluation  Results.  The  Defense  Contract  Audit  Agency  audits  of  contractor 
compliance  with  the  Cost  Accounting  Standards  add  value  and  consistency  to  the 
negotiation  of  cost-based  contracts.  When  contracts  are  negotiated  based  on  costs,  which 
is  common  practice  for  most  unique  weapons  systems,  the  Cost  Accounting  Standards 
provide  measurement  rules  that  ensure  consistency  among  bids  and  are  understandable  by 
all  parties.  Compliance  with  the  rules  is  monitored  and  verified  through  audits  The 
Government  has  realized  significant  monetary  benefits  through  audit  findings  related  to 
contractor  accounting  changes  and  noncompliances  with  the  standards,  as  discussed  in 
Appendix  B.  The  Defense  Contract  Audit  Agency  could,  nevertheless,  improve 
procedures  for  auditing  contractor  compliance  with  the  Cost  Accounting  Standards  We 
identified  three  conditions  that  require  management  actions. 

•  Audit  planning  procedures  need  to  be  improved.  Field  audit  offices  did  not 
fully  consider  risk  and  materiality  assessments  in  the  planning  process  and  did 
not  update  control  logs  to  record  audit  results  for  future  planning  needs  The 
field  audit  office  Management  Information  System  did  not  generate  current  and 
accurate  data.  Instead,  Cost  Accounting  Standards  audits  were  routinely 
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scheduled  on  a  3-year  cycle.  Unless  audits  are  planned  with  consideration  of 
all  relevant  information,  audit  resources  are  not  used  efficiently  and  effectively 
(Finding  A). 

•  Field  audit  offices  were  not  adequately  documenting  testing  for  compliance 
with  Cost  Accounting  Standards  401,  “Consistency  in  Estimating, 
Accumulating,  and  Reporting  Costs,”  and  402,  “Consistency  in  Allocating 
Costs  Incurred  for  the  Same  Purpose.”  Also,  25  percent  of  the  workpaper 
packages  that  we  reviewed  on  other  Cost  Accounting  Standards  audits  were 
either  inadequate  or  did  not  support  the  audit  opinion.  As  a  result  of 
deficiencies,  contractor  proposed  and  incurred  costs  may  be  improperly 
measured  and  allocated,  and  the  Government  may  be  overpaying  on  contracts 
(Finding  B). 

•  Defense  Contract  Audit  Agency  guidance  allowed  for  a  negative  assurance 
opinion  when  reporting  on  contractor  compliance  with  the  Cost  Accounting 
Standards.  The  expressed  opinion  did  not  fully  adhere  to  the  Government 
reporting  standards.  Compliance  reports  also  do  not  identify  the  accounting 
period  for  which  testing  was  performed.  The  resulting  reports  did  not 
necessarily  provide  procurement  officials  with  relevant  and  reliable  information 
to  use  in  negotiating  and  administering  Government  contracts  (Finding  C). 

Summary  of  Planned  Defense  Contract  Audit  Agency  Actions.  We  discussed  the 
results  of  our  evaluation  with  management  and  recommended  corrective  actions  at  a 
March  12,  1998,  conference  Management  responded  on  May  20,  1998,  with  a  specific 
action  plan  to  modify  or  clarify  current  audit  guidance  on  risk  assessments,  revise  internal 
control  log  procedures,  assess  management  information  system  problems,  integrate 
compliance  testing  for  some  standards  into  all  relevant  audits,  reevaluate  standard  audit 
programs,  ensure  audits  are  properly  supervised,  and  research  Government  Auditing 
Standards  to  modify  reporting  procedures  as  indicated 

Summary  of  Recommendations.  The  planned  actions  address  the  conditions  identified 
during  our  evaluation  However,  we  recommend  that  the  Defense  Contract  Audit  Agency 
require  regional  and  field  audit  office  managers  to  assign  responsibilities  for  the 
maintenance  and  updating  of  data  in  the  information  system. 

Management  Comments.  The  Defense  Contract  Audit  Agency  partially  concurred  with 
our  findings  but  nonconcurred  with  the  recommendation,  stating  that  the  field  audit 
manager  is  responsible  for  the  accuracy  of  data  in  the  information  system  However, 
management  will  issue  a  guidance  memorandum  to  reemphasize  the  importance  of 
maintaining  current  and  accurate  data  on  Cost  Accounting  Standards  audits.  See  Part  I 
for  a  complete  discussion  of  management  comments  and  Part  HI  for  the  complete  text  of 
management  comments. 

Evaluation  Response.  The  May  1998  action  plan  was  generally  responsive  to  the 
majority  of  report  findings.  Management’s  additional  planned  action  on  data  assurance 
meets  the  intent  of  the  recommendation  on  the  maintenance  of  current  CAS  audit  data  in 
the  management  information  system. 
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Part  I  -  Evaluation  Results 


Evaluation  Background 


The  Cost  Accounting  Standards.  Between  1972  and  1980,  the  Cost  Accounting 
Standards  (CAS)  Board  issued  19  standards  to  make  the  cost  accounting  practices 
that  govern  the  measurement,  assignment,  and  allocation  of  costs  to  Government 
contracts  uniform  and  consistent.  Periodically,  the  CAS  Board  issues 
interpretations  and  amendments  to  the  standards.  Public  Law  100-679  requires 
contractors  and  subcontractors  to  comply  with  the  CAS  and  to  disclose  in  writing 
and  follow  consistently  their  cost  accounting  practices  provided  they  meet  certain 
criteria.  They  must  have  received  either  a  single  CAS-covered  contract  award  of 
$25  million  or  more,  or  received  $25  million  or  more  in  CAS-covered  contract 
awards  during  the  preceding  cost  accounting  period  with  at  least  one  award 
exceeding  $1  million. 

The  CAS  are  codified  in  48  Code  of  Federal  Regulation  Chapter  99  Federal 
Acquisition  Regulation  (FAR)  part  30,  “CAS  Administration,”  describes  the 
policies  and  procedures  for  applying  the  CAS  rules  and  regulations  to  negotiated 
contracts  and  subcontracts.  FAR  subpart  30.2,  “CAS  Program  Requirements,” 
and  FAR  subpart  30.6,  “CAS  Administration,”  address  the  responsibilities  of  the 
contract  auditor  in  implementing  the  standards 

Government  Auditing  Standards.  Government  Auditing  Standards  (GAS) 
incorporate  the  auditing  standards  issued  by  the  American  Institute  of  Certified 
Public  Accountants  (AICPA)  and  go  beyond  those  standards  for  matters  unique  to 
Government  audits.  Supplemental  GAS  include  requirements  for  testing 
compliance  with  laws  and  regulations. 

Defense  Contract  Audit  Agency  (DCAA)  Role.  The  DCAA  reports  to  the 
Administrative  Contracting  Officer  (ACO)  on  the  adequacy  and  compliance  of 
contractor  disclosure  statements  and  on  whether  or  not  disclosed  and  established 
practices  comply  with  FAR  part  31,  “Contract  Cost  Principles  and  Procedures,” 
and  applicable  CAS  DCAA  must  assess  whether  a  contractor  is  required  to  file  a 
disclosure  statement  and  determine  which  standards  are  applicable  and  material  to 
the  contractor’s  accounting  system  The  DCAA  must  also  provide  timely 
assistance  to  the  ACO  in  performing  the  administrative  responsibilities  detailed  in 
FAR  subpart  30.6. 

Value  of  CAS  Compliance  Audits.  The  DCAA  audits  of  contractor  compliance 
with  CAS  add  value  and  consistency  to  the  negotiation  of  cost-based  contracts. 
When  contracts  are  negotiated  based  on  costs,  which  is  common  practice  for  most 
unique  weapons  systems,  CAS  provides  measurement  rules  that  ensure  consistency 
among  bids  and  are  understandable  by  all  parties  in  the  negotiation.  Through  CAS 
audits,  DCAA  monitors  and  verifies  the  preparation  of  claims  or  change  orders, 
the  reimbursement  of  incurred  costs  on  cost-type  contracts,  and  whether 
contractor  cost  accounting  systems  produce  reliable  information  for  bid  proposals 
CAS  audits  provide  reasonable  assurance  in  negotiations  that  the  Government  and 
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contractors  are  protected  against  inequitable  or  inconsistent  cost  allocations.  In 
recent  years,  the  Government  has  realized  significant  monetary  benefits  related  to 
DCAA  findings  in  CAS  audits.  See  Appendix  B. 

Results  of  DCAA  Internal  Review.  In  1997,  the  DCAA  performed  an  internal 
review  to  determine  the  efficiency  and  effectiveness  of  CAS  audit  procedures  and 
to  improve  Agency  audit  guidance  as  necessary.  We  received  the  results  of  the 
internal  review,  which  included  no  specific  recommendations,  in  January  1998 

Evaluation  Objectives 

The  overall  objective  was  to  evaluate  the  adequacy  of  the  DCAA  procedures  for 
auditing  contractor  compliance  with  the  CAS.  The  evaluation  assessed  the 
adequacy  of  audit  guidance,  audit  programs,  training  materials,  planning 
procedures,  audit  coverage,  and  reporting.  See  Appendix  A  for  the  evaluation 
scope  and  methodology. 
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Finding  A.  Adequacy  of  the  Audit 
Planning  Process 

Field  audit  offices  (FAOs)  needed  to  improve  the  CAS  audit  planning 
process,  including  risk  assessments,  updating  of  control  logs,  and 
information  system  data  maintenance. 

•  FAO  management  did  not  properly  incorporate  risk  and 
materiality  assessments  in  the  audit  planning  process  because 
management  was  not  implementing  Agency  guidelines.  DCAA 
guidance  also  required  routine  scheduling  of  Cost  Accounting 
Standards  audits  on  a  3 -year  cycle,  which  may  contribute  to  the 
diminished  emphasis  on  risk  assessments. 

•  Auditors  did  not  update  the  Mandatory  Annual  Audit 
Requirements  (MAAR)  control  logs  or  Internal  Control  Audit 
Planning  Summary  (ICAPS)  sheets  to  record  audit  results  and 
facilitate  risk  assessments  and  future  planning.  The  updating 
did  not  occur  because  field  management  was  not  implementing 
Agency  guidelines  on  control  schedule  maintenance. 

•  Information  in  CAS  status  reports  was  not  current  because 
FAO  management  had  not  clearly  assigned  responsibilities  for 
monitoring  and  updating  data  Also,  the  available  data  codes 
and  edit  checks  were  inadequate  to  produce  reliable  CAS 
information. 

The  scheduling  and  performance  of  audits  without  consideration  of 
appropriate  risk  factors  and  the  lack  of  current  status  information  on  CAS 
audits  and  reports  resulted  in  inefficient  management  of  audit  planning  and 
followup  efforts. 


Risk  and  Materiality  Determinations  in  the  Planning  Process 


Audit  Planning  Policy  and  Guidance.  The  CAM,  the  Audit  Planning  Manual, 
and  standard  CAS  audit  programs  contain  DCAA  audit  planning  policy  and 
guidance.  CAM  chapter  8-305,  “CAS  Compliance  Testing,”  covers  the 
consideration  of  risk  and  materiality  in  developing  the  extent  and  frequency  of 
CAS  compliance  testing.  CAM  8-305.2  provides  the  following  criteria  for 
establishing  compliance  testing  requirements: 

Identify  those  provisions  of  a  standard  that  are  significant  to  the 
particular  contractor.  The  materiality  criteria  published  in  48  CFR 
9903  305  must  be  considered  carefully  ..If  a  noncompliance  with  a 
CAS  provision  would  have  no  significant  impact  on  either 
Government  contract  costs  or  the  administrative  and  audit  effort,  there 
is  no  reason  to  test  whether  the  contractor  is  complying  with  the 
provisions.  If  a  provision  is  considered  immaterial,  then  document 
this  on  the  requirements  plan  working  papers.  The  materiality 
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decision  should  be  reconsidered  whenever  relevant  circumstances 
change.  This  step  will  be  done  for  each  CAS  covered  contractor .  . 

Section  B  of  each  standard  CAS  compliance  audit  program  restates  these  planning 
considerations.  The  audit  program  also  requires  the  supervisor  and  the  auditor  to 
review  the  risk  assessment  for  agreement  on  the  audit  scope  and  audit  resources 
required 

Field  Audit  Office  Performance  of  Risk  and  Materiality  Assessments.  FAOs 
do  not  fully  consider  the  risk  and  materiality  of  a  potential  noncompliance  with 
applicable  standards  when  planning  CAS  audits.  Several  FAOs  either  programmed 
audits  for  CAS  not  applicable  to  the  contractor  or  the  segment  under  the  FAO 
cognizance  or  did  not  program  an  audit  for  a  Standard  that  was  applicable. 

FAOs  encompass  both  resident  audit  offices  and  branch  audit  offices  The  resident 
audit  offices  visited  maintained  CAS  permanent  files  with  generally  accurate  CAS 
applicability  schedules.  However,  neither  the  CAS  applicability  schedules  nor  the 
permanent  files  evidenced  materiality  assessments  of  the  individual  standards  The 
branch  audit  offices  did  not  maintain  CAS  applicability  schedules  on  a  consistent 
basis  When  maintained,  the  schedules  did  not  have  materiality  assessments  of  the 
individual  applicable  standards  and  there  was  little  indication  that  schedules  were 
used  in  the  planning  process.  At  one  branch  office,  the  CAS  applicability  schedule 
for  a  major  contractor  indicated  that  1 1  standards  applied.  However,  DCAA  had 
performed  no  compliance  audits  for  the  3 -year  period  covered  in  our  review 

FAOs  are  not  implementing  DCAA  policy  and  guidance  that  require  the  ready 
availability  of  information  needed  for  risk  and  materiality  assessments  DCAA 
internal  assessment  disclosed  similar  problems  related  to  the  inefficient  use  of  audit 
resources  Their  assessment  noted  several  instances  of  audits  performed  in  low 
risk  circumstances  when  standards  were  not  material  at  the  contractor  location 


Routine  Cycling  of  CAS  Audits 

The  DCAA  policy  on  CAS  compliance  audit  coverage  requires  that  audits 
generally  be  scheduled  routinely  on  a  3-year  cycle  CAM  chapter  8-305.2  states 
that  “As  a  minimum,  CAS  compliance  audits  on  all  applicable  and  significant 
standards  should  be  done  every  three  years.”  The  section  further  states:  “If  the 
three-year  cycle  is  not  maintained,  explanations  should  be  included  in  the 
requirements  plan  working  papers.” 

Compliance  with  DCAA  Policy.  FAOs  were  adhering  to  DCAA  policy  on  the 
3-year  cycle  instead  of  using  risk  and  materiality  assessments  as  a  basis  for 
scheduling  CAS  compliance  audits.  All  except  one  of  the  offices  in  our  survey 
routinely  programmed  CAS  compliance  testing  on  a  3-year  cycle.  The  exception 
was  the  FAO  that  completed  no  compliance  testing  at  a  major  contractor  in  the 
3-year  evaluation  period. 

Adequacy  of  DCAA  Policy.  The  current  DCAA  CAM  guidance  promotes 
scheduling  CAS  audits  routinely  on  a  3-year  cycle  without  consideration  for  risk 
and  materiality.  Although  the  DCAA  policy  permits  deviation  from  the  3 -year 
cycle,  it  does  not  discuss  the  circumstances  that  would  allow  for  the  deviation 
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As  a  result,  FAOs  do  not  vary  from  the  3-year  cycle.  The  routine  scheduling  of 
audits  regardless  of  risk  and  materiality  considerations  is  an  inefficient  use  of  FAO 
audit  resources. 

The  FAOs  included  in  DCAA  internal  assessment  believed  that  a  reevaluation  of 
the  policy  for  the  3 -year  compliance  testing  cycle  is  necessary  The  offices 
suggested  that  risk  assessment  should  play  a  greater  part  in  the  scheduling  of 
compliance  audits. 


Requirements  to  Update  Related  Audit  Control  Logs 

DCAA  Guidance.  The  concluding  steps  in  all  DCAA  standard  CAS  compliance 
audit  programs  include  a  requirement  to  update  permanent  file  information  such  as 
the  MAARs  and  ICAPS  control  logs.  The  requirement  facilitates  the  management 
of  an  audit  office  since  permanent  files  provide  FAO  management  information 
needed  to  plan  audits  and  manage  resources  The  audit  procedures  performed  to 
satisfy  the  requirements  of  CAS,  MAARs,  and  system  internal  control  audits  bear  a 
close  relationship  to  each  other.  The  results  from  each  of  these  audits  yield 
information  essential  to  the  total  risk  assessment  and  the  audit  planning  process. 

The  MAARs  are  basic  criteria  and  audit  procedures  that  must  be  used  in  the 
contract  audit  environment  to  comply  with  GAS.  The  ICAPS  summarize  the 
auditor  assessment  of  control  risk  and  the  impact  of  the  assessment  on  related 
contract  audit  effort.  FAOs  generally  complete  MAARs  as  part  of  incurred  cost 
audits.  Incurred  cost  audit  objectives  determine  acceptable  costs  associated  with 
CAS  allocability  and  measurement  criteria  The  updating  of  MAARs  control  logs 
for  CAS  compliance  audit  results  and  reported  CAS  issues  satisfy  the 
accomplishment  of  certain  MAARs  objectives  ICAPS  should  be  updated 
continually  to  reflect  the  results  of  all  audits,  including  CAS 

Updating  of  Control  Logs.  None  of  the  FAOs  updated  the  MAARs  or  the 
ICAPS  control  logs  to  reflect  the  results  of  CAS  compliance  testing  or  reported 
CAS  issues.  FAO  management  was  not  following  agency  guidelines  to  use  all 
relevant  information  in  the  planning  process  The  result  is  duplicative  audit  effort. 
To  ensure  that  guidance  is  properly  implemented,  management  needs  to  assign 
responsibilities  for  maintaining  current  data  in  the  information  system. 

DCAA  internal  assessment  also  noted  that  FAOs  did  not  update  the  MAARs 
control  logs.  FAO  management  attributed  this  to  confusion  over  the  relationship 
between  the  CAS  and  the  MAARs. 


Maintenance  of  System  Information 

According  to  CAM  section  8-304.2,  “Compliance  Considerations,”  FAO 
Management  Information  System  (FMIS)  summaries  will  provide  a  list  of  audits 
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performed  that  support  the  opinions  on  CAS  compliance  included  in  audit  reports. 
The  summaries  are  to  be  used  as  an  audit  management  tool  for  assuring  that 
adequate  CAS  compliance  testing  is  performed. 

CAM  section  3-104.15,  “Planning  in  Connection  with  Cost  Accounting 
Standards,”  also  explains  that  the  results  of  CAS  compliance  audits  can  be 
extremely  useful  in  establishing  the  audit  scope  of  other  assignments.  The  FMIS 
CAS  Compliance  Testing  Reports  included  in  the  permanent  files  provide  an 
overview  of  the  status  of  contractor’s  compliance  with  the  standards  and  helps 
identify  specific  areas  needing  consideration. 

Maintenance  of  Accurate  Information.  Some  FAOs  are  not  updating  the  FMIS 
CAS  status  reports  because  management  has  not  assigned  clear  responsibilities  for 
monitoring  and  correcting  the  information  in  the  information  system.  In  addition, 
current  edit  checks  do  not  prevent  information  from  being  inappropriately  purged 
from  the  system.  One  FAO  had  reports  with  “unresolved”  issues  dating  back  to 
the  early  1990’s.  In  some  cases,  FAOs  had  received  evidence  of  the  ACO 
resolution  but  did  not  update  the  system  information  Another  FAO  resolved  more 
than  30  “overage”  CAS  issues  by  changing  the  status  codes  in  the  system.  The 
FAO  made  the  changes  without  communicating  with  the  ACO  to  determine  the 
actions  taken  to  resolve  the  issue  Because  the  system  included  inappropriate 
criteria  for  purging  data  at  year-end,  one  FAO  did  not  know  to  follow  up  with  an 
ACO  on  a  Disclosure  Statement  adequacy  determination. 

DCAA  plans  four  modifications  to  the  FMIS  to  correct  the  problems  with  data 
accuracy  and  completeness.  The  modifications  address  coding  and  edit  check 
problems  identified  in  both  the  IG  and  the  DCAA  reviews.  DCAA  proposed  no 
action  to  address  the  maintenance  of  FMIS  system  information 


DCAA  Comments  on  Findings  and  Evaluation  Response 

DCAA  Comments.  DCAA  partially  concurred  or  concurred  in  principle  with  the 
findings  on  the  adequacy  of  the  audit  planning  process;  however,  they  took 
exception  to  presentation  findings  DCAA  did  not  agree  with  our  statement  that 
scheduling  and  performing  audits  without  consideration  of  appropriate  risk  factors 
and  without  current  CAS  status  information  resulted  in  inefficient  management  of 
audit  planning  and  follow-up.  DCAA  commented  that  three  of  the  four  offices 
visited  performed  and  documented  some  level  of  planning  based  on  risk  and 
materiality  They  also  pointed  out  that  report  statements  addressing  the  lack  of 
compliance  testing  of  a  major  contractor  at  one  branch  office  did  not  clearly  limit 
the  finding  to  one  office 

Evaluation  Response.  We  acknowledge  DCAA  concerns  on  certain  report 
statements  and  have  revised  the  wording  in  two  statements  for  clarification.  The 
revisions  in  Finding  A  are  as  follows:  The  first  sentence  in  the  paragraph  entitled 
“Field  Audit  Office  Performance  of  Risk  and  Materiality  Assessments”  now  reads 
FAOs  do  not  fully  consider  the  risk  and  materiality  of  a  potential  noncompliance 
with  applicable  standards  when  planning  CAS  audits.  The  last  sentence  in  the 
“Compliance  with  DCAA  Policy”  paragraph  is  clarified  as  follows-  “The  exception 
was  the  FAO  that  completed  no  compliance  testing  at  a  major  contractor  in  the 
3-year  evaluation  period.  The  last  sentence  in  the  second  paragraph  under 
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“Field  Audit  Office  Performance  of  Risk  and  Materiality  Assessments”  clearly 
refers  to  the  prior  sentence  that  limits  our  observation  to  one  major  contractor. 
Therefore,  no  changes  are  necessary. 

DCAA  took  exception  to  the  words  “without  consideration  of’  in  the  following 
statement  in  Finding  A  -  Adequacy  of  the  Audit  Planning  Process:  “The 
scheduling  and  performance  of  audits  without  consideration  of  appropriate  risk 
factors  and  a  lack  of  current  status  information  on  CAS  audits  and  reports  resulted 
in  inefficient  management  of  audit  planning  and  followup  efforts.”  We  have  not 
changed  the  original  wording.  As  stated  in  our  report,  FAOs,  to  a  greater  or  lesser 
degree,  were  determining  and  documenting  the  applicability  of  standards 
However,  FAOs  were  not  assessing  the  risk  and  materiality  of  a  potential 
noncompliance  with  a  particular  standard  or  with  specific  provisions  within  a 
standard.  DCAA  audit  planning  policy  and  guidance  clearly  addresses  the  need  to 
assess  risk  and  materiality  of  the  individual  standards  and  the  discrete  provisions 
within  the  standards.  None  of  the  offices  visited  had  documented  the 
consideration  of  risk  and  materiality  of  a  potential  noncompliance  as  part  of  the 
planning  process. 


DCAA  Corrective  Actions 


We  discussed  the  results  of  our  evaluation  with  management  and  recommended 
corrective  actions.  DCAA  has  prepared  the  following  action  plan: 

1.  Modify  Contract  Audit  Manual  guidance  on  planning  Cost  Accounting 
Standards  compliance  audits  to  clarify  that  a  risk  assessment  be  performed  either 
during  the  program  planning  process  or  when  the  assignment  is  established  The 
modification  will  also  emphasize  the  importance  of  determining  the  applicability 
dates  of  revised  standards  and  the  applicability  of  standards  controlled  by 
corporate  offices.  The  milestone  date  for  issuing  the  modified  guidance  to  the 
regions  is  June  30,  1999. 

2.  Develop  risk  assessment  working  papers  for  each  Standard  to  supplement  the 
tailored  electronic  working  papers  risk  assessment  The  regions  and  the  field 
detachment  are  responsible  for  working  paper  development  The  milestone  date 
for  finalizing  risk  assessments  and  dissemination  to  the  field  audit  offices  is 
June  30,  1999. 

3.  Prepare  a  point  paper  on  alternative  compliance  testing  cycles,  giving 
consideration  to  using  a  risk  based  audit  approach  to  timing  the  frequency  of 
performing  Cost  Accounting  Standards  compliance  audits.  Audit  policy  will  be 
revised  and  clarified  as  needed  The  milestone  date  for  revising  and  clarifying 
audit  policy  is  June  30, 1999. 

4.  Modify  compliance  audit  programs  to  identify  interrelationships  between  audit 
steps  and  the  Internal  Control  Audit  Planning  Summaries  and  Mandatory  Annual 
Audit  Requirements.  Milestone  date  is  June  30,  1999. 
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5.  Revise  the  Internal  Control  Audit  Planning  Summaries  and  Mandatory  Annual 
Audit  Requirements  to  accommodate  Cost  Accounting  Standards  testing  results. 
The  milestone  date  is  June  30, 1999. 

6.  Assess  the  feasibility  of  modifying  data  entry  form  DCAA  Form  7000-S  to 
improve  data  accuracy  and  completeness 

The  planned  actions  will  address  all  conditions  except  the  need  for  controls  over 
FMIS  information 


Recommendation,  DCAA  Comments,  and  Evaluation 
Response 

We  recommend  that  the  Director,  Defense  Contract  Audit  Agency,  require 
regional  and  field  management  to  specifically  assign  responsibilities  to  an 
individual  for  the  maintenance  of  current  and  accurate  data  on  Cost 
Accounting  Standards  audits  in  the  Field  Management  Information  System. 

DCAA  Comments.  The  DCAA  nonconcurred  stating  that  they  believe 
responsibilities  for  maintaining  FMIS  are  appropriately  assigned  as  described  in 
FMIS  User  Manual.  At  the  field  audit  office  level,  the  responsibility  for 
maintaining  FMIS  accuracy  is  specifically  assigned  to  the  FAO  Manager.  DCAA 
further  states  that  their  Headquarters  Workload  Analysis  Division  (OWD)  has 
recently  conducted  field  visits  on  FMIS  accuracy,  which  disclosed  no  findings  on 
FMIS  input  related  to  CAS  audits.  Therefore,  they  do  not  believe  that  the 
inaccuracies  found  by  the  IG  are  prevalent  to  warrant  a  change  in  Agency  policy 
DCAA  does  not  believe  that  assigning  responsibility  to  another  individual,  instead 
of  the  FAO  manager,  would  solve  the  problem.  Rather,  they  will  issue  a  guidance 
MRD  specifically  on  CAS  compliance  audits  to  reemphasize  the  importance  of 
maintaining  current  and  accurate  data  for  FAO  planning 

Evaluation  Response.  Although  DCAA  nonconcurred,  management's  planned 
action  to  issue  a  guidance  memorandum  is  responsive  to  the  intent  of  our 
recommendation.  However,  we  do  not  agree  with  the  statement  that  based  on 
OWD  field  visits  the  inaccuracies  are  not  prevalent.  We  were  advised  by  OWD 
that  their  field  visits  did  not  test  the  accuracy  of  CAS  status  report  information 
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Performance 

None  of  the  FAOs  documented  specific  testing  of  CAS  401,  “Consistency 
in  Estimating,  Accumulating,  and  Reporting  Costs,”  and  CAS  402, 
“Consistency  in  Allocating  Costs  Incurred  for  the  Same  Purpose.”  Also, 

25  percent  of  the  CAS  audit  workpaper  packages  that  we  reviewed  were 
either  inadequate  or  did  not  support  the  audit  opinion.  This  situation 
occurred  because  FAOs  were  not  following  DCAA  guidance  on 
compliance  testing,  documentation,  and  supervisory  oversight  of  audits. 
Applicable  procedures  needed  improvement  to  provide  better  assurance 
that  assignments  were  performed  in  accordance  with  the  Government 
auditing  standards  on  due  professional  care. 

Inadequate  audit  coverage  increases  the  risk  that  contractor  proposed  and 
incurred  costs  are  improperly  measured  and  allocated  and  costs  paid  by  the 
Government  are  overstated  as  a  result. 


Quality  of  Audit  Performance 


GAS  requires  due  professional  care  in  the  performance  of  audits  and  the 
preparation  of  related  reports  Due  professional  care  means  the  exercise  of 
judgment  in  establishing  the  audit  scope,  the  performance  and  documentation  of 
tests  and  procedures  in  workpapers  to  support  an  audit  opinion,  and  adequate 
supervisory  guidance  and  review.  Under  the  additional  GAS  requirements, 
auditors  are  required  to  design  tests  to  provide  reasonable  assurance  of 
compliance  with  laws  and  regulations  applicable  to  the  costing  and  pricing  of 
Government  contracts,  describe  the  scope  of  compliance  testing  in  audit  reports; 
and  report  on  instances  of  noncompliance. 

All  GAS  requirements  are  addressed  in  the  CAM  and  incorporated  in  audit 
programs,  including  supervision,  documentary  evidence,  preparation  of  working 
papers,  and  reporting  requirements  CAM  chapter  2,  “Auditing  Standards,”  relates 
GAS  to  the  DCAA  audit  process.  Accordingly,  DCAA  must. 

•  maintain  accurate  and  reliable  records  that  summarize  the  applicability 
and  materiality  of  the  CAS  to  contractors,  the  adequacy  of  contractor 
disclosure  statements,  provide  a  history  of  compliance  testing  and 
reporting  of  noncompliances,  and  record  the  current  status  of 
outstanding  issues, 

•  plan  and  manage  the  performance  of  CAS  audits  to  ensure  efficient  use 
of  resources;  and 

•  ensure  that  the  performance  and  reporting  of  CAS  audits  comply  with 
GAS. 

DCAA  Guidance  on  Performing  CAS  Audits.  DCAA  establishes  a  separate 
workpaper  package  for  audits  of  all  standards  except  CAS  401  and  402 
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CAS  401  and  402  address  the  overall  consistent  application  of  a  contractor’s 
accounting  practices,  and  the  criteria  are  pervasive.  As  a  result,  auditors  are  to  be 
continuously  aware  of  any  estimating  or  accounting  practice  that  is  inconsistent 
with  the  requirements  of  the  two  Standards.  DCAA  policy  on  the  testing  of  CAS 
401  and  402  is  addressed  in  the  CAM  and  in  the  Agency’s  audit  planning  manual, 
as  follows: 


Plan  testing  for  compliance  with  CAS  401  and  402  during  the 
performance  of  audit  assignments  such  as  proposal  evaluations  and 
incurred  cost  audits  (CAM  8-305). 

Separate  activity  codes  for  CAS  Standards  401  and  402  compliance 
testing  have  not  been  established  as  these  audit  steps  are  considered  to 
be  such  an  integral  part  of  every  audit  of  a  CAS  covered  contractor 
that  compliance  testing  and  documentation  are  to  be  recorded  in  each 
individual  audit  assignment  (DCAA  Audit  Planning  Manual). 

Adequacy  of  CAS  Audit  Coverage  and  Reporting.  FAOs  neither  performed 
nor  documented  testing  of  contractor  compliance  with  CAS  401  and  402  In 
addition,  approximately  25  percent  of  the  special  CAS  audit  assignments  covering 
the  remaining  Standards  needed  improvements  in  testing,  documentation,  and 
supervisory  guidance  and  review  to  comply  with  GAS  and  DCAA  policy. 

The  credibility  and  usefulness  of  the  information  DCAA  provides  to  contracting 
officers  depend  on  auditor  adherence  to  GAS.  Management  controls  incorporated 
in  the  supervisory  review  and  FAO  quality  control  process  did  not  ensure  that 
these  assignments  were  performed  in  accordance  with  the  GAS  on  due 
professional  care. 

Compliance  Audits.  The  level  of  testing  in  15  of  50  CAS  compliance  audits  was 
not  sufficient  to  support  the  overall  audit  opinion  In  one  audit,  the  auditor  relied 
on  an  internal  audit  report  as  a  basis  for  expressing  the  opinion  that  the  contractor 
complied  with  CAS  411,  “Accounting  for  Acquisition  Costs  of  Material.” 

However,  the  internal  audit  was  limited  to  testing  the  Material  Management 
Accounting  System  standards  unrelated  to  the  cost  accumulation  and  allocation 
requirements  contained  in  CAS  41 1 .  Another  compliance  audit  was  limited  to 
performing  tests  of  criteria  already  known  to  be  noncompliant  and  awaiting  ACO 
determination.  The  limitation  in  scope  was  not  documented  in  the  workpapers,  the 
audit  program,  or  in  the  audit  report  issued  to  the  ACO.  Although  the  FAO  used 
over  240  hours  to  complete  the  assignment,  the  audit  report  on  contractor 
compliance  with  CAS  410,  “Allocation  of  Business  Unit  General  and 
Administrative  Expenses  to  Final  Cost  Objectives,”  provided  no  new  information 

Disclosure  Statement  Audits.  We  reviewed  14  disclosure  statement 
audits  The  workpapers  in  four  of  the  audits  did  not  support  the  opinions  in  the 
reports  issued  to  the  ACO.  In  two  cases,  we  found  that  the  audit  workpapers  did 
not  support  the  basis  for  the  auditor’s  conclusions  on  the  adequacy  and  compliance 
of  the  revised  accounting  practices  or,  in  one  case,  the  immateriality  of  the  cost 
impact  In  two  other  cases,  the  supervisor  limited  the  scope  of  the  audit  to  an 
adequacy  determination  without  coordinating  with  the  ACO.  Despite  the 
supervisor’s  scope  limitation,  the  auditor  identified  potential  noncompliance  issues 
with  three  Standards.  Both  the  regulations  and  DCAA  policy  require  the  auditor 
to  report  material  noncompliant  practices  to  the  ACO  for  a  determination 
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DCAA  policy  requires  notification  in  a  separate  report  The  FAO  never  issued 
noncompliance  reports  to  the  ACO  and  never  established  and  performed  separate 
compliance  audits  for  the  revised  cost  accounting  practices. 

Noncompliance  Reports.  The  workpaper  files  in  four  of  3 1  CAS 
noncompliance  report  assignments  did  not  document  why  a  report  was  never 
prepared  or  explain  how  the  issue  was  resolved. 

Use  of  Special  CAS  Audits  for  Compliance  Testing.  The  establishment  of 
separate  CAS  audit  workpaper  packages  to  test  contractor  compliance  with  each 
standard  provides  visibility  of  audit  accomplishments  However,  DCAA  also 
recognizes  the  need  for  continuous  monitoring  of  contractor  compliance  with  CAS 
401  and  402  in  other  audits,  particularly  in  forward  pricing  audits,  because  these 
standards  apply  to  most  audits.  The  same  rationale  applies  to  CAS  405, 
“Accounting  for  Unallowable  Costs,”  and  CAS  406,  “Cost  Accounting  Period.” 

In  meetings  with  DCAA,  management  agreed  to  consider  the  feasibility  of  revising 
current  audit  programs  to  incorporate  compliance  testing  for  some  CAS  in 
incurred  cost  or  forward  pricing  audits. 


DCAA  Comments  on  Findings  and  Evaluation  Response 

DCAA  Comments.  DCAA  partially  concurred  with  our  observations  on  audit 
adequacy.  While  agreeing  that  auditors  had  not  adequately  documented  CAS  401 
and  402  testing,  DCAA  did  not  believe  that  a  lack  of  documentation  of  testing 
represents  inadequate  audit  coverage.  However,  management  stated  that  they 
have  revised  all  relevant  audit  programs  to  clearly  identify  audit  steps  necessary  to 
perform  compliance  testing  of  CAS  401  and  402  to  facilitate  better  documentation. 
DCAA  partially  concurred  with  our  observations  on  the  audits  considered 
inadequate.  They  did  not  agree  that  8  of  the  23  audits  cited  were  inadequate.  In 
regard  to  our  observations  on  Disclosure  Statement  audits,  DCAA  provided  the 
following  comments:  "While  we  agree  that  the  reasons  for  not  issuing  a  report 
should  have  been  documented,  we  do  not  believe  merely  failing  to  document  the 
adequate  resolution  of  the  issues  either  affected  the  credibility  and  usefulness  of 
the  information  provided  to  the  contracting  officers."  Additionally,  management 
took  exception  with  our  opinion  that  existing  procedures  were  insufficient  to 
ensure  that  these  assignments  were  performed  in  accordance  with  GAS  on  due 
professional  care 

Evaluation  Response.  We  consider  the  DCAA  May  20,  1998,  corrective  action 
plan  to  be  responsive  to  the  report  findings  on  the  need  for  improved  controls  over 
audit  performance.  DCAA  comments  indicated  that  they  interpreted  our  statement 
on  the  credibility  and  usefulness  of  information  provided  to  the  ACO  as  applying 
solely  to  the  observations  on  Disclosure  Statement  audits  The  statement  cited  in 
DCAA  response  applies  to  all  the  assignments  considered  inadequate  For 
clarification,  we  have  moved  this  statement  to  the  first  paragraph  under  "Adequacy 
of  CAS  Audit  Coverage  and  Reporting"  previously  discussed  in  this  report  The 
reported  observations  were  based  on  an  evaluation  of  workpaper  packages  using 
GAS  criteria  and  DCAA  CAM  guidance.  Due  professional  care  is  a  general 
standard  that  is  not  limited  to  auditor  qualifications  The  Standard  imposes  an 
audit  responsibility  to  observe  the  standards  of  field  work  and  reporting  This 
includes  planning  and  supervision,  knowledge  of  the  organization  being  audited, 
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obtaining  sufficient  competent  evidential  matter  to  support  the  auditor's  opinion, 
and  preparing  working  papers  that  support  the  auditor's  conclusions  and 
judgments.  In  our  opinion,  of  the  95  workpaper  packages  evaluated,  23  did  not 
comply  with  either  the  requirements  of  GAS  or  DCAA  audit  guidance.  In  most 
cases,  the  workpaper  packages  did  not  contain  sufficient  competent  evidential 
matter  to  support  the  auditor's  conclusions,  which  in  turn,  reflects  on  the  adequacy 
of  supervision.  We  considered  DCAA  guidance  to  be  adequate  in  terms  of  clearly 
communicating  the  requirements  for  performing  audits  with  due  professional  care. 
We  concluded  that  the  cause  of  the  identified  deficiencies  was  that  existing 
-management  quality  control  procedures  were  not  ensuring  the  proper 
implementation  of  DCAA  guidance. 


DCAA  Corrective  Actions 


We  discussed  the  results  of  our  evaluation  with  management  and  recommended 
corrective  actions  DCAA  has  prepared  the  following  action  plan 

1 .  Review  all  relevant  audit  programs  to  determine  whether  audit  steps  are 
included  to  test  the  provisions  of  Cost  Accounting  Standards  401,  402,  405,  and 
406  and,  if  not,  where  such  testing  would  logically  occur.  Modify  Contract  Audit 
Manual  guidance  and  audit  programs  as  needed  to  more  clearly  establish  the  link 
between  the  requirements  of  each  of  those  four  standard  and  specific  audit  steps  or 
procedures.  DCAA  issued  guidance  on  September  30,  1998. 

2.  Address  the  level  of  transaction  testing  in  the  risk  assessment  working  papers 
being  developed  for  each  standard  as  proposed  in  Finding  A,  Corrective  Action  2 

3.  Evaluate  each  Cost  Accounting  Standard  compliance  audit  program  for 
improvements  to  provide  additional  guidance  on  testing  for  compliance  with 
significant  provisions  The  action  will  be  accomplished  together  with  the 
development  of  the  risk  assessment  workpapers  proposed  in  Finding  A,  Corrective 
Action  2. 

4  Direct  the  regions  to  take  management  actions  to  ensure  that  Cost  Accounting 
Standards  audits  are  properly  managed  and  supervised  to  accomplish  an  acceptable 
level  of  audit  quality  by  June  30, 1998,  and  evaluate  audit  quality  by  December  31, 
1998. 

5.  Extend  the  concept  of  integrating  compliance  testing  into  all  relevant  audits  for 
Cost  Accounting  Standards  405,  “Accounting  for  Unallowable  Costs,”  and  406, 
’’Cost  Accounting  Period.” 

The  planned  corrective  actions  are  responsive  to  the  finding  and  no  additional 
recommendations  are  being  made  in  this  report. 
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Finding  C.  Cost  Accounting  Standards 
Compliance  Reporting 

Opinion  statements  in  compliance  reports  did  not  follow  prescribed  AICPA 
and  Government  Auditing  Standards  when  a  negative  assurance  statement 
was  used  and  compliance  reports  did  not  specify  the  period  of  audit 
performance. 

The  expression  of  an  inappropriate  opinion  and  the  omission  of 
performance  period  information  from  the  report  lessen  the  usefulness  of  the 
information  to  the  ACO  and  can  increase  the  risk  of  Government  not  being 
able  to  enforce  the  price  adjustment  provisions  of  the  CAS  clause. 


Use  of  Negative  Assurance  Statements 

Government  Auditing  Standards  Requirements.  GAS  reporting  standards 
establish  specific  circumstances  under  which  a  negative  assurance  statement  is 
allowed  The  use  of  negative  assurance  is  limited  to  circumstances  where  the 
scope  of  work  performed  is  less  than  an  audit  and  the  limitation  is  significant 
enough  to  prevent  the  auditor  from  expressing  a  positive  opinion  When  a 
negative  assurance  statement  is  used,  the  report  must  clearly  indicate  the  scope 
limitations  and  must  also  disclaim  a  positive  opinion 

AICPA  standards  purposely  limit  circumstances  under  which  a  negative  assurance 
statement  is  allowed  since  a  negative  assurance  wording  is  vague  and  ambiguous 
and,  therefore,  has  the  potential  to  mislead  the  user  of  the  audit  report 
Furthermore,  a  qualified  opinion  combined  with  a  negative  assurance  statement  is 
not  an  option  under  reporting  standards. 

DCAA  Reporting  Practices.  The  DCAA  opinion  statement  does  not  conform 
with  the  prescribed  reporting  standards.  CAM  chapters  8,  “Cost  Accounting 
Standards,”  and  10,  “Preparation  and  Distribution  of  Audit  Reports,”  cover 
reporting  practices  CAM  10-805  specifically  addresses  the  reporting  of 
compliance  audit  results.  DCAA  policy  requires  a  report  to  be  issued  to  the  ACO 
under  all  circumstances.  When  no  noncompliances  are  found,  guidance  requires 
the  report  to  express  a  qualified  opinion  and  to  include  a  negative  assurance 
statement. 


Reporting  Period  of  Audit  Performance 

Performance  and  Reporting  Requirements.  DCAA  guidance  on  reporting  the 
results  of  compliance  audits  does  not  require  the  report  narrative  to  identify  the 
cost  accounting  period  in  which  compliance  testing  was  performed  CAS 
compliance  audit  program  guidance  generally  limits  the  performance  of  required 
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Finding  C.  Cost  Accounting  Standards  Compliance  Reporting 


compliance  tests  to  the  contractor’s  current  fiscal  year  accounting  practices 
although  CAS  compliance  audits  are  planned  and  performed  only  once  every 
3  years. 

Contracting  Officer  Requirements.  Information  on  contractor  compliance  with 
CAS  is  required  for  various  contract  audit  issues.  Contracting  officers  need  to  be 
aware  of  a  contractor  compliance  status  when  awarding  contracts,  when 
negotiating  forward  pricing  rates  and  factors,  and  when  negotiating  prior  year 
overhead  rates  and  factors.  These  actions  involve  different  cost  accounting 
periods.  The  identification  of  the  accounting  period  to  which  the  compliance 
testing  applies  provides  the  procurement  officials  with  useful  information  in 
negotiating  and  administering  Government  contracts. 

Under  the  price  adjustment  provisions  of  the  contract  clause  in  FAR 
subpart  52.230-2,  “Cost  Accounting  Standards,”  the  date  of  compliance  testing 
becomes  an  important  factor  in  protecting  the  Government’s  right  to  cost 
recovery.  FAR  52.230-2(a)(5)  requires  contractors  and  subcontractors  to  agree  to 
contract  price  adjustments,  with  interest,  if  their  failure  to  comply  with  CAS  or  to 
consistently  follow  their  disclosed  and  established  cost  accounting  practices  results 
in  increased  costs  to  the  Government.  Identifying  the  period  to  which  the  specific 
CAS  compliance  testing  applies  would  limit  the  opportunities  for  a  defense  based 
on  estoppel  should  a  routine  forward  pricing  or  incurred  cost  audit  reveal  a 
noncompliance  issue  in  an  accounting  period  in  which  no  specific  CAS  audits  were 
performed. 


DCAA  Corrective  Actions 


We  discussed  the  results  of  our  evaluation  with  management  and  recommended 
corrective  actions.  DCAA  has  prepared  the  following  action  plan. 

1 .  Modify  the  Contract  Audit  Manual  to  provide  examples  of  Cost  Accounting 
Standards  audit  reports  that  are  appropriately  adjusted  for  scope  limitations 
Reconcile  reporting  requirements  to  audit  programs  for  scope  limitations,  as 
necessary. 

2.  Research  the  Government  Auditing  Standards  regarding  opinions  with  negative 
assurance  Identify  other  audits  that  provide  negative  assurance  to  develop  a 
consistent  approach  for  reporting  such  audit  results. 

The  milestone  for  issuance  of  guidance  to  the  regions  on  the  action  items  is 
June  30,  1999. 

The  planned  corrective  actions  are  responsive  to  the  finding  and  no  additional 
recommendations  are  being  made  in  this  report 
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Part  II  -  Additional  Information 


n 


Appendix  A.  Evaluation  Process 


Scope 

Work  Performed.  We  conducted  the  evaluation  from  October  1997  through 
January  1998  and  made  field  visits  to  four  FAOs.  We  evaluated  the  overall 
adequacy  of  DCAA  procedures  for  auditing  contractor  compliance  with  CAS.  The 
evaluation  assessed  the  adequacy  of  audit  guidance,  audit  programs,  planning 
procedures,  audit  coverage,  and  audit  reporting.  Our  scope  was  limited  in  that  we 
did  not  include  tests  of  management  controls. 

DoD-Wide  Corporate  Level  Government  Performance  and  Results  Act 
Goals.  In  response  to  the  Government  Performance  and  Results  Act,  the 
Department  of  Defense  has  established  6  DoD-wide  corporate  level  performance 
objectives  and  14  goals  for  meeting  these  objectives.  This  report  pertains  to 
achievement  of  the  following  objective  and  goal. 

Objective:  Fundamentally  reengineer  the  Department  and  achieve  a 
218"  century  infrastructure.  Goal:  Reduce  costs  while  maintaining  required 
military  capabilities  across  all  DoD  mission  areas.  (DoD-6) 

DoD  Functional  Area  Reform  Goals.  Most  major  DoD  functional  areas  have 
also  established  performance  improvement  reform  objectives  and  goals  This 
report  pertains  to  achievement  of  the  following  functional  area  objective  and  goal 

Objective:  Internal  reinvention  Goal:  Minimize  cost  growth  in  major 
defense  acquisition  programs  to  no  greater  than  1  percent  annually. 

(ACQ-3.4) 

General  Accounting  Office  High-Risk  Area.  The  General  Accounting  Office 
has  identified  several  high-risk  areas  in  the  Department  of  Defense.  This  report 
provides  coverage  of  the  Defense  Contract  Management  high-risk  area 


Methodology 

Use  of  Computer-Processed  Data.  No  computer-processed  data  were  used  in 
the  course  of  the  audit. 

Universe  and  Sample  Selection.  We  judgmentally  selected  four  offices  from  four 
DCAA  regions  The  office  selections  were  based  on  an  analysis  of  data  extracted 
from  the  DCAA  Agency  Management  Information  System.  The  four  FAOs 
included  two  resident  audit  offices  and  two  branch  offices  to  ensure  oversight  of 
DCAA  audit  coverage  at  both  major  and  non-major  contractors.  Additional 
criteria  used  for  field  office  selection  included,  the  overall  volume  of  CAS  activity, 
the  type  of  audit  activity  generating  noncompliance  reports,  and,  whether  office 
staff  included  a  CAS  technical  specialist 
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Our  visits  included  a  review  of:  contractor  CAS  planning  documents;  Contract 
Audit  Coordinator  documentation,  when  applicable;  and  assignments  in  all  CAS 
activity  areas.  We  evaluated  a  total  of  101  assignments  as  follows: 


Assignment  Code 

Description 

Assignments  Reviewed 

19100 

Disclosure  Statement  Audits 

14 

19200 

Noncompliance  Reports  1 

31 

19400 

Compliance  Audits 

50 

19500 

Cost  Impact  Audits 

4 

Misc. 

2 

Contacts  During  the  Evaluation.  Discussions  were  held  with  representatives 
from  DCAA  Headquarters,  Regional  Offices,  FAOs,  and  the  Defense  Logistics 
Agency. 


’DCAA  uses  special  noncompliance  report  audit  assignments,  code  19200,  to  account  for  the  additional 
audit  effort  required  to  report  and  resolve  a  noncompliance  issue  discovered  during  another  audit  The 
special  assignment  is  only  opened  after  the  auditor  has  completed  all  audit  work  in  the  original 
assignment  in  which  the  issue  was  discovered  The  DCAA  management  information  system  disclosed 
that  for  the  period  reviewed,  FYs  95-97,  less  than  30  percent  of  CAS  noncompliance  issues  reported 
resulted  from  CAS  compliance  audits.  The  remaining  issues  were  discovered  during  other,  routine 
audits. 
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Appendix  B.  Continued  Need  for  Cost  Accounting 
Standards 


From  October  1, 1995,  through  March  31, 1998,  the  Government  saved 
$138  million  related  to  DCAA  findings  of  improper  contractor  accounting  changes 
and  other  CAS  noncompliances.  During  FY  1997,  major  contractors  also 
voluntarily  deleted  over  $2  billion  of  unallowable  expenses  from  claims  submitted 
to  the  Government.  The  amounts  are  significant  and  evidence  the  continued 
validity  of  General  Accounting  Office  1970  conclusions  in  a  report  to  Congress  on 
the  need  for  uniform  cost  accounting  standards. 

General  Accounting  Office  Study.  Congress  had  requested  the  1970  General 
Accounting  Office  study  because  of  the  significant  increase  in  non-competitive, 
negotiated  procurements  in  which  the  Government  used  contractor  cost  estimates 
to  negotiate  the  contract  price.  The  study  concluded  that  the  Government  cost 
principles  contained  in  the  FAR  were  not  adequate  for  contract  costing.  The  cost 
principles  are  based  on  Generally  Accepted  Accounting  Principles  (GAAP)  and 
accounting  methods  accepted  for  income  tax  purposes  by  the  Internal  Revenue 
Service. 

The  purpose  of  GAAP  is  to  report  cost  information  for  financial  statement 
purposes  GAAP  was  developed  primarily  for  stockholder  use  and  protection,  not 
to  control  expenditures  on  Government  contracts  GAAP  allocates  costs  between 
fiscal  years  but  not  between  products  and  services  within  a  fiscal  year  Tax  laws 
and  regulations  are  designed  to  meet  social  goals,  such  as  revenue  raising,  and 
accounting  procedures  designed  to  comply  with  tax  regulations  are  also  not  useful 
for  contract  costing  or  to  prevent  overpricing. 

The  GAO  concluded  that  when  prices  are  set  without  competition  and  the 
restraints  of  the  market  place,  cost  data  needs  to  play  an  important  role  in  the 
negotiation,  administration,  and  settlement  of  contracts  Cost  accounting 
standards  would  provide  uniformity  and  consistency  in  accounting  practices  used 
for  negotiating  and  administering  contracts,  improve  understanding  and 
communication  between  contractors  and  the  Government,  and  reduce  contract 
disputes. 

Continued  Protection  Warrants  Continued  Need.  CAS  continues  to  provide 
some  protection  for  the  Government  and  contractors  against  inequitable  or 
inconsistent  cost  allocations.  The  Government  continues  to  negotiate  many  large 
contracts  for  unique  items  for  which  cost  or  pricing  data  are  required  The 
Government  may  also  allow  equitable  adjustments  of  costs  on  fixed-price  contracts 
provided  the  contractor  can  substantiate  a  cost  overrun.  The  maintenance  of  a 
reliable  cost  accounting  system  for  the  consistent  accumulation  and  recording  of 
costs  is  essential  for  an  equitable  adjustment  to  be  approved  Without  uniform  and 
consistent  standards  for  allocating  costs  to  contracts,  costs  can  readily  be  shifted 
from  commercial  contracts,  for  which  cost  adjustments  may  not  be  available,  to 
Government  contracts  that  provide  for  changes  and  price  adjustments  Some  of 
the  standards  are  of  special  significance  in  the  current  environment  of  numerous 
corporate  consolidations.  Other  standards  facilitate  contractor  preparation  of  cost 
proposals  that  exclude  costs  unacceptable  for  reimbursement  with  Government 
revenues. 
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Asset  Valuations.  GAAP  requires  that  assets  be  revalued  after  mergers 
and  acquisitions.  If  the  purchase  method  is  used  to  revalue  assets,  depreciation 
and  amortization  costs  may  increase  drastically  to  be  passed  on  as  increased  costs 
on  Government  contracts.  Assets  may  also  have  been  purchased  specifically  for 
use  on  Government  contracts,  and  the  Government  may  already  have  reimbursed 
the  contractor  My  for  the  assets  through  normal  depreciation. 

Contractor  Pension  Plans.  Government-funded  pension  assets  must  be 
properly  allocated  during  business  combinations  to  ensure  that  future  contracts  do 
not  bear  a  disproportionate  share  of  pension  costs.  CAS  412,  “Composition  and 
Measurement  of  Pension  Costs,”  and  CAS  413,  “Adjustment  and  Allocation  of 
Pension  Costs,”  provide  contractors  and  the  Government  criteria  for  assigning, 
valuing,  and  allocating  pension  costs.  CAS  413  also  provides  guidance  for 
ensuring  that  Government-funded  pension  assets,  which  amount  to  billions  of 
dollars,  remain  available  to  offset  future  pension  costs  on  Government  contracts 

Accounting  for  Unallowable  Costs.  CAS  405  facilitates  the  negotiation, 
audit,  administration,  and  settlement  of  contracts  by  requiring  contractors  to 
identify  expressly  unallowable  costs.  Major  contractors  voluntarily  delete  large 
amounts  of  FAR  unallowable  expenses  from  overhead  claims.  Unless  contractors 
are  required  to  account  for  unallowable  expenses,  the  Government  assumes  an 
unacceptable  risk  that  those  costs  will  be  included  in  contract  prices. 

Conclusion.  CAS  enhances  and  promotes  competition  by  increasing 
comparability  between  cost  estimates  and  actual  cost  performance  In  addition, 
the  proper  implementation  and  enforcement  of  CAS  prevents  requests  for 
unnecessary  Government  directed  deviations  from  disclosed  cost  accounting 
practices.  CAS  does  not  generally  require  contractors  to  charge  costs  in  a  certain 
manner,  only  that  they  consistently  follow  their  disclosed  practice. 

CAS  does  not.  apply  to  commercial  contracts  and  should  not  be  viewed  as  an 
impediment  to  civil-military  integration.  Congress  has  also  given  DoD  the 
authority  to  use  “Other  Transactions”  to  encourage  commercial  firms  to  advance 
dual-use  technology  and  broaden  the  industrial  base.  These  “Other  Transactions” 
are  exempt  from  typical  audit  requirements  including  CAS  However,  where  the 
Government  continues  to  base  procurement  decisions  on  cost  measurements,  the 
Standards  will  serve  an  essential  purpose. 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Director,  Defense  Procurement 

Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 


Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 


Non-Defense  Organizations  and  Individuals 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional  committees 
and  subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  National  Security 
House  Committee  on  Governmental  Reform  and  Oversight 
House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal  Justice, 
Committee  on  Government  Reform  and  Oversight 
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Defense  Contract  Audit  Agency 
Comments 


IX  UN.V  ItKI  TO 


PAC  730.40/98-2 


DEFENSE  CONTRACT  AUDIT  AGENCY 


•725  JOHN  J.  KINGMAN  ROAD,  SUITE  2135 
FORT  BEL  VOIR,  V  A  22MM219 


14  October  1998 


MEMORANDUM  FOR  ASSISTANT  INSPECTOR  GENERAL,  POLICY  AND  OVERSIGHT, 
DEPARTMENT  OF  DEFENSE 


SUBJECT:  Response  to  DoDIG  Draft  Report  on  Evaluation  of  DCAA  Audits  of  Contractor 
Compliance  with  Cost  Accounting  Standards  (Project  No  70C-9047) 

As  requested,  we  have  reviewed  the  subject  draft  report  Our  response  to  the  draft  report 

follows: 


As  you  know,  prior  to  your  review  we  had  already  initiated  a  review  of  the  effectiveness  of  CAS 
compliance  audits.  We  identified  the  areas  of  potential  improvement  to  the  CAS  compliance  audit 
process  through  our  field  visits  This  assessment  of  the  areas  of  improvement  was  provided  to  you  in  our 
29  January  1998  memorandum  During  the  12  March  1998  exit  conference,  you  advised  us  that  many  of 
your  findings  were  similar  to  our  review  results  Our  action  plan  to  improve  CAS  audits  was  provided  to 
you  during  the  20  May  1998  follow-up  exit  conference.  We  believe  these  DCAA  initiatives  should  be 
reflected  in  the  Executive  Summary  (section  entitled  Planned  Management  Actions)  and  the  Evaluation 
Background  (section  entitled  Results  of  DCAA  Internal  Review).  Although  we  are  experiencing  delays 
with  some  of  the  milestones  identified  in  the  action  plan,  we  have  made  significant  progress  on  the  action 
items.  We  will  advise  you  when  the  milestones  are  complete 

The  draft  report  identified  one  recommendation  that  would  require  regional  or  field  managers  to 
specifically  assign  responsibilities  to  an  individual  for  maintaining  current  and  accurate  data  in  the  Field 
Management  Information  System  (FMIS).  We  do  not  concur  with  this  recommendation  Wc  believe  the 
assignment  of  responsibilities  is  adequately  addressed  in  the  current  FMIS  User  Manual 

More  importantly,  we  do  not  agree  with  certain  conclusions  and  characterization  of  the  findings. 
We  believe  that  the  magnitude  of  the  problems  is  unfairly  presented  in  the  draft  report  Further,  we 
strongly  disagree  with  the  IG  finding  that  DCAA  audit  procedures  were  '‘insufficient  to  ensure  that  these 
assignments  were  performed  in  accordance  with  the  Government  Auditing  Standards  on  due  professional 
care  " 


Our  detailed  response  to  the  recommendation  and  comments  to  your  findings  are  enclosed  If 
you  have  any  questions,  please  contact  Ms,  Hyosun  Ro,  Program  Manager,  at  (703)  767-3257,  or  Ms. 
France*  Cornett,  Chief,  Accounting  and  Cost  Principles  Division,  at  (703)  767-3250 


Assistant  Director 
Policy  and  Plans 

Enclosure:  Response  to  DoDIG  Draft  Report 
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Response  to  DoDKG  Draft  Report  on  Evaluation  of  DCAA  Audits  of  Contractor 
Compliance  with  Cost  Accounting  Standards  (Projects  No.  70C-9047) 

Recommendation  for  Corrective  Action  -  Maintenance  of  System  Information 

We  recommend  that  the  Director,  Defense  Contract  Audit  Agency,  require  regional  and 
field  management  to  specifically  assign  responsibilities  to  an  individual  for  the  maintenance  of 
current  and  accurate  data  on  Cost  Accounting  standards  audits  in  the  Field  Management 
Information  System 

DCAA  Response 

We  do  not  concur.  We  believe  responsibilities  for  maintaining  FMIS  are  appropriately 
assigned  as  described  in  FMIS  User  Manual.  At  the  field  audit  office  level,  the  responsibility  for 
maintaining  FMIS  accuracy  is  specifically  assigned  to  the  FAO  manager.  The  Manual  states: 

The  Assistant  Director,  Operations,  has  overall  responsibility  for 
the  following: 

•  Design  and  operation  of  the  FMIS. 

•  Maintaining  the  FMIS  User  Manual  on  a  current  and  complete 
basis. 

•  Providing  advice  regarding  the  technical  accuracy  of  data 
elements  included  in  the  FMIS  and  ensuring  definitions  are 
consistent  with  existing  audit  policy  and  guidance. 

Regional  Directors,  Heads  of  Principal  Staff  Members, 

Headquarters,  DCAA,  and  FAO  managers  are  responsible  for 
ensuring  that  the  instructions  prescribed  in  this  manual  are  adhered 
to  in  the  preparation  and  submission  of  FMIS  data,  (emphasis 
added) 

DCAA  Headquarters  Workload  Analysis  Division  (OWD)  has  recently  conducted  field 
visits  on  FMIS  accuracy.  They  found  no  processes  or  data  inaccuracies  that  affect  the  Agency’s 
statistics  as  a  whole.  However,  OWD  identified  some  areas  for  improvement  and  has  issued  an 
MRD  (98-OWD-077(R),  dated  10  August  1998)  reemphasizing  the  importance  of  the  accuracy 
of  the  FMIS  data.  The  MRD  required  each  FAO  to  reassess  their  own  FMIS  processes  and 
internal  controls  related  to  those  areas  identified  and  initiate  corrective  actions  It  also  reinforced 
that  the  regions  should  continue  to  monitor  FMIS  data  accuracy  as  part  of  their  quality  assurance 
programs. 

The  OWD  field  visits  disclosed  no  findings  on  FMIS  input  related  to  CAS  audits. 
Therefore,  we  do  not  believe  that  the  FMIS  inaccuracy  on  CAS  audits  found  by  the  IG  is 
prevalent  to  warrant  the  change  in  Agency  policy  Assigning  responsibility  to  another  individual 
instead  of  the  FAO  manager  would  not  seem  to  solve  the  problem.  Rather,  we  will  issue  an 


ENCLOSURE 
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Final  Report 
Reference 


Revised 


Response  to  DoDIG  Draft  Report  on  Evaluation  of  DCAA  Audits  of  Contractor 
Compliance  with  Cost  Accounting  Standards  (Projects  No,  7OC-9047) 

MRD  specifically  on  CAS  compliance  audits  to  reemphasize  the  importance  of  the  maintenance 
of  current  and  accurate  data  for  FAO  planning. 

Finding  A.  Adequacy  of  the  Audit  Planning  Process 

Field  audit  offices  (FAOs)  needed  to  improve  the  CAS  audit  planning  process,  including 
risk  assessments,  updating  of  control  logs,  and  information  system  data  maintenance. 

The  scheduling  and  performance  of  audits  without  consideration  of  appropriate  risk 
factors  and  the  lack  of  current  status  information  on  CAS  audits  and  reports  resulted  in 
inefficient  management  of  audit  planning  and  follow-up  efforts. 

DCAA  Response 

Partially  concur.  We  agree  that  improvement  is  needed  in  documentation  of  risk  and 
materiality  factors  considered  in  planning  CAS  audits  However,  we  do  not  agree  with  the 
statement  that  the  scheduling  and  performance  of  audits  without  consideration  of  appropriate 
risk  factors  and  the  lack  of  current  status  information  on  CAS  audits  and  reports  resulted  in 
inefficient  management  of  audit  planning  and  follow-up  efforts.  As  discussed  below,  the  FAOs 
do  consider  risk  factors  and  current  information  on  CAS  audits  in  planning  and  performing  CAS 
audits  We  believe  the  detailed  description  of  the  reported  condition  and  the  nature  of  the  finding 
are  overstated. 

Field  Audit  Office  Performance  of  Risk  and  Materiality  Assessments, 

FAOs  do  not  consider  the  risk  and  materiality  of  a  potential  noncompliance  with 
applicable  standards  when  planning  CAS  audits. 

...At  one  branch,  the  CAS  applicability  schedule  for  a  major  contractor  indicated  that  11 
standards  applied  However,  DCAA  had  performed  no  compliance  audits  for  the  3-)*ear  period 
covered  in  our  review  . 

DCAA  Response 

Partially  concur.  We  agree  that  the  process  can  be  improved  to  ensure  more  efficient 
planning  and  belter  documentation  of  materiality  and  risk  considerations.  We  disagree  with  tbc 
global  statement  that  FAOs  do  not  consider  risk  and  materiality  of  a  potential  noncompliance 
with  applicable  standards  when  planning  CAS  audits  Three  of  the  four  offices  visited  by  the  TG 
performed  and  documented  some  level  of  planning  based  on  the  risk  and  materiality  as 
demonstrated  to  the  IG  during  the  field  visits  One  FAO,  which  is  a  resident  office  for  a  major 
contractor,  maintained  a  CAS  three-year  planning  schedule,  which  we  believe  is  adequate  for  a 
major  contractor  where  all  standards  that  are  scheduled  for  review  are  applicable  and  material. 
The  FAO  also  used  the  FM1S  system  as  an  audit  management  tool  to  assure  that  required  reviews 
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were  adequately  planned  and  performed.  Another  FAO,  also  a  resident  office,  uses  a  matrix 
planning  document  that  covers  the  3  year  cycle  for  coverage  of  applicable  standards  for  the 
various  profit  centers  for  the  contractor.  This  document  clearly  displays  the  compliance  reviews 
for  each  standard  by  profit  center,  the  year  of  the  last  review,  and  the  year  of  the  next  planned 
review.  The  IG  reviewed  this  document  and  stated  that  it  appears  to  demonstrate  coverage  of  all 
relevant  CAS  standards  over  a  3-year  period.  The  third  FAO  manager  at  a  branch  location 
maintains  a  status  board  showing  mobile  CAS  covered  contractors  and  the  status  of  each  planned 
CAS  compliance  audit.  Thus,  CAS  covered  contractors  and  CAS  applicability  are  identified  and 
controlled  by  the  FAO  manager  for  the  branch  as  a  whole.  In  addition,  one  mobile  team 
maintained  formal  documentation  regarding  CAS  planning,  and  two  suboffice  locations  also 
maintained  CAS  applicability  schedules  and  schedules  showing  results  of  recent  compliance 
testing. 

Regarding  the  statement  that  “DCAA  had  performed  no  compliance  audits...'*,  the 
example  used  by  the  IG  was  an  isolated  case  at  one  contractor  location  at  one  branch  office.  This 
statement  wrongly  implies  that  this  was  a  DCAA-widc  problem. 

Updating  Control  Logs 

FA  Os  are  not  updating  the  MAARs  or  the  ICAPS  control  logs  to  reflect  the  results  of  CAS 
compliance  testing  or  reported  CAS  issues .  FAO  management  is  not  following  agency  guidelines 
to  use  all  relevant  information  in  the  planning  process  The  result  is  duplicative  audit  effort.  To 
ensure  that  guidance  is  properly  implemented,  management  needs  to  assign  responsibilities  for 
maintaining  current  data  in  the  information  system 

PCAA 

Concur  in  principle.  Although  no  instances  were  identified  in  the  draft  report  that  the 
failure  to  update  (he  MAARs  or  the  ICAPS  control  logs  to  reflect  the  results  of  CAS  audits 
resulted  in  duplicative  effort,  we  agree  that  documentation  would  be  useful  to  avoid  potential 
duplicative  effort.  As  included  in  our  action  plan,  we  will  modify  the  CAS  compliance  audit 
programs  and  MAARs  and  ICAPS  forms  to  better  identify  the  interrelationship  between  CAS 
compliance  audit  steps  and  specific  ICAPS  and  MAARs. 

Routine  Cycling  of  CAS  Audits 

The  exception  was  an  FAO  that  completed  no  compliance  testing  in  the  3 -year  evaluation 

period. 

DCAA  Response 

This  is  an  incorrect  statement.  It  was  only  one  contractor  at  a  branch  location  where  no 
separate  audit  for  compliance  testing  was  performed  in  the  3 -year  evaluation  period. 
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Rinding  B.  Management  Needs  to  Improve  Controls  Over  Audit  Performance 

FA  Os  did  not  document  specific  testing  required  by  CAS  401,  "Consistency  in 
Estimating,  Accumulating,  and  Reporting  Costs , "  and  CAS  402,  "Consistency  in  Allocating 
Costs  incurred  for  the  same  purpose ... "  Also  25%  of  all  CAS  audit  workpaper  packages  were 
either  inadequate  or  did  not  support  the  audit  opinion . ..  Existing  procedures  were  insufficient 
to  ensure  that  these  assignments  were  performed  in  accordance  with  the  Government  auditing 
standards  on  due  professional  care 

Inadequate  audit  coverage  increases  the  risk  that  the  contractor  proposed  and  incurred 
costs  are  improperly  measured  and  allocated  and  costs  paid  by  the  Government  are  overstated 
as  a  result. 

DCAA  Response 

Partially  concur.  We  agree  that  CAS  401  and  402  testing  was  not  always  documented. 
However,  we  do  not  believe  that  the  lack  of  documentation  of  CAS  401  and  402  represents 
inadequate  audit  coverage  based  on  the  reasons  discussed  below  under  Adequacy  of  CAS  Audit 
Coverage  and  Reporting.  In  addition,  we  do  not  concur  with  the  statement  that  25%  (23/95)  of 
all  CAS  audit  workpaper  packages  reviewed  were  either  inadequate  or  did  not  support  the  audit 
opinion  The  IG  found  23  audits  inadequate  We  analyzed  the  23  audits  and  found  8  audits 
which  should  not  fall  under  this  inadequate  category.  Of  the  15  remaining  audits,  8  were 
attributable  to  one  FAO,  one  supervisor  and  one  auditor,  which  we  believe  represent  an  isolated 
performance  matter  that  is  being  addressed  by  management.  Based  on  our  calculation,  at  most, 
the  percentage  of  the  inadequate  audits  of  the  total  audits  reviewed  should  be  16%  (15/95).  If  the 
anomaly  relates  to  the  single  performance  matter  is  removed,  the  percentage  would  be  further 
reduced  to  8%  (7/95) 

In  light  of  the  above,  we  strongly  disagree  with  the  IG  statement  that  existing  procedures 
were  insufficient  to  ensure  that  these  assignments  were  performed  in  accordance  with  the 
Government  auditing  standards  on  due  professional  care. 

Adequacy  of  CAS  Audit  Coverage  and  Reporting 

FA  Os  neither  performed  nor  documented  testing  of  contractor  compliance  with  CAS  40] 
and  402  ... 

The  level  of  testing  in  15  of  50  CAS  compliance  audits  was  not  sufficient  to  support  the 
overall  audit  opinion  . 
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Partially  concur.  We  disagree  with  the  statement  that  FAOs  did  not  perform  testing  of 
contractor  compliance  with  CAS  401  and  402.  While  we  agree  that  CAS  401  and  402  testing 
was  not  adequately  documented,  contractor  compliance  with  CAS  401  and  402  is  considered  in 
potentially  all  transaction  testing  in  most  audit  assignments.  Certain  Agency  standard  audit 
programs  already  contain  specific  audit  steps  requiring  consideration  of  CAS  401/402 
requirements.  For  example,  the  audit  programs  for  forward  pricing  rates  and  price  proposals 
contain  audit  steps  requiring  testing  for  compliance  with  disclosed  or  established  practices.  This 
step,  although  it  is  not  always  annotated  as  such,  is  testing  compliance  with  CAS  401.40(a) 
During  our  field  visits,  we  found  no  instances  where  any  FAO  failed  to  identify  noncompliances 
with  CAS  401  and  402.  Further,  we  detennined  that  during  FYs  1995  and  1996,  about  16 
percent  of  all  noncompliance  reports  issued  were  noncompliance  with  CAS  401  and  402.  Some 
of  these  noncompliance  reports  were  provided  to  the  IG  by  the  FAOs  during  the  IG  field  visits. 
Nevertheless,  we  have  already  revised  all  relevant  audit  programs  to  clearly  identify  the  audit 
steps  necessary  to  perform  compliance  testing  of  CAS  401  and  402  to  facilitate  better 
documentation. 

Regarding  the  statement  that  the  level  of  testing  in  15  of  50  CAS  compliance  audits  was 
not  sufficient  to  support  the  overall  audit  opinion,  our  analysis  shows  3  of  the  reported  audits  do 
not  fall  under  this  category  One  of  the  audits  was  cited  for  not  supporting  the  testing  of  all  CAS 
provisions.  Although  this  was  not  discussed  during  the  exit  conference,  you  informed  us  that  the 
provisions  that  were  not  supported  were  CAS  404.50(d)  and  (e).  These  CAS  404  provisions 
relate  to  asset  valuations  as  a  result  of  business  combination.  The  contractor  had  no  such 
acquisitions  that  would  trigger  applicability  of  these  provisions,  and,  therefore,  these  audit  steps 
were  not  applicable  at  this  contractor.  Also,  we  found  that  the  IG  counted  one  audit  as  three 
because  there  were  three  assignment  numbers  associated  with  that  audit.  This  audit  covered 
three  profit  centers  which  had  identical  accounting  practices,  and  the  assignment  numbers  merely 
represented  the  profit  centers.  Only  one  audit  assignment  was  established,  and  only  one  report 
was  issued  for  this  audit.  Of  the  12  audits  remaining,  9  audits  are  attributable  to  one  FAO,  of 
which  8  audits  were  performed  by  one  supervisor  and  one  auditor.  The  nature  of  inadequate 
performance  was  identical  in  all  eight  assignments.  Therefore,  we  believe  the  magnitude  of  the 
finding  is  misleading  since  the  majority  (8/12)  of  the  inadequate  audits  represents  an  anomaly 
attributable  to  one  supervisor  and  one  auditor  involving  the  identical  audit  technique  for  the  eight 
audits.  At  most,  these  audits  should  be  counted  as  one  occurrence  of  inadequacy. 


We  reviewed  14  disclosure  statement  audits  The  workpapers  in  4  of  the  audits  did  not 
support  the  opinions  in  the  reports  issued  to  the  ACO.. ,  In  two  cases,  we  found  that  the  audit 
workpapers  did  not  support  the  basis  for  the  auditor's  conclusions,,. 
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In  two  other  cases .  the  supervisor  limited  the  scope  of  the  audit  to  an  adequacy 
determination  without  coordinating  with  the  ACO.  Despite  the  supervisor 's  scope  limitation ,  the 
auditor  identified  potential  noncompliance  issues  with  three  standards  . 

. .  The  FA  Os  never  issued  noncompliance  reports  to  the  ACO  and  never  established  and 
performed  separate  compliance  audits  for  the  revised  cost  accounting  practices. 


PCAA  fiesp<?n?s 

Partially  concur.  We  do  not  concur  with  two  of  the  four  audits  found  inadequate.  As 
discussed  with  the  IG  during  the  field  visit*  the  FAO  coordinated  with  the  ACO  who  requested  to 
limit  scope  to  an  adequacy  review  to  expedite  the  report  on  adequacy.  Although  this  was  not 
documented,  the  FAO  provided  the  IG  a  copy  of  the  ACO  adequacy  determination  letter  that 
stated  a  compliance  review  would  be  done  later  The  ACO  believes  that  his  determination  letter 
provides  adequate  evidence  for  FAO  coordination  and  declined  to  provide  a  written 
confirmation.  Therefore,  we  do  not  believe  this  finding  is  accurately  presented. 

Regarding  the  statement,  "the  FAOs  never  issued  noncompliance  reports...,”  the  FAO 
explained  to  the  IG  that  the  matter  had  been  resolved  internally.  Based  on  the  discussions 
between  the  auditor  and  the  supervisor/F  AO  manager,  it  was  determined  that  there  were  no 
noncompliances  to  report 

Also,  the  word,  is  incorrect  because  it  was  ope  FAO  involved  in  this  issue 

NoncompJiance  Reports 

The  workpaper  files  in  4  of  SI  CAS  noncompliance  report  assignments  did  not  document 
why  a  report  was  never  prepared  or  explain  how  the  issue  was  resolved 

The  credibility  and  usefulness  of  the  information  DCAA  provides  to  contracting  officers 
depend  on  auditor  adherence  to  GAS.  Management  Controls  incorporated  in  the  supervisory 
review  and  FAO  quality  control  process  did  not  ensure  these  assignments  were  performed  in 
accordance  vdth  the  GAS  on  due  professional  care. 

DCAA  Response 

Partially  concur  We  do  not  concur  with  three  of  the  four  audits  found  inadequate.  The 
FAOS  provided  to  the  IG  adequate  explanations  as  to  why  a  report  was  never  issued  or  how  the 
issue  was  resolved.  One  of  these  assignments  was  closed  with  no  audit  effort  expended  because 
the  issue  was  determined  immaterial.  Another  audit  was  opened  based  on  an  audit  lead  from  a 
review  of  an  incurred  cost  submission.  However,  as  indicated  in  the  contractor’s  response  to  the 
draft  noncompliance  report,  the  contractor  revised  the  inclined  cost  submission  to  correct  the 
condition  upon  which  the  audit  lead  was  based.  As  a  result,  no  noncompliance  report  was  issued 
In  the  third  audit,  the  ACO  was  fully  apprised  of  the  matter  and  negotiated  a  settlement  with  the 
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contractor  before  the  audit  report  was  issued.  Since  the  matter  was  settled,  an  audit  report  would 
serve  no  useful  purpose.  Thus,  the  FAO  decision  was  proper. 

While  we  agree  that  the  reasons  for  not  issuing  a  report  should  have  been  documented, 
we  do  not  believe  merely  failing  to  document  the  adequate  resolution  of  the  issues  either  affected 
the  credibility  and  usefulness  of  the  information  provided  to  contracting  officers.  Further,  we  do 
not  believe  failure  to  document  the  resolution  of  the  issue  justifies  the  IG  finding  that  these 
audits  were  not  performed  in  accordance  with  the  GAS. 
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